bugtraq - RE: Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 2 Aug 2006 14:50:04 -0400
From: "Roger A. Grimes" <roger@...neretcs.com>
To: <gssincla@...software.com>, <bugtraq@...urityfocus.com>
Subject: RE: Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01]

Just to correct, versions up to 3.3.03.053 are vulnerable. The poster
correctly said so in the subject, but then puts the wrong ending version
in the details.

Roger

*****************************************************************
*Roger A. Grimes, InfoWorld, Security Columnist 
*CPA, CISSP, MCSE: Security (2000/2003/MVP), CEH, yada...yada...
*email: roger_grimes@...oworld.com or roger@...neretcs.com
*Author of Professional Windows Desktop and Server Hardening (Wrox)
*http://www.amazon.com/gp/product/0764599909
*****************************************************************

-----Original Message-----
From: gssincla@...software.com [mailto:gssincla@...software.com] 
Sent: Tuesday, August 01, 2006 5:18 PM
To: bugtraq@...urityfocus.com
Subject: Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01]

Title: Barracuda Hardcoded Password Vulnerability
Severity: High (Sensitive Information Disclosure)
Date: 01 August 2006
Version Affected: Barracuda Spam Firewall version 3.3.01.001 to
3.3.03.053 Discovered by: Greg Sinclair (gssincla@...software.com)
Discovered on: 28 May 2006

Overview:
Barracuda Spam Firewalls (www.barracudanetworks.com) are vulnerable to
information disclosure which is made possible by a default guest
password

Details:
The Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 have
a hardcoded password for the "guest" account in the Login.pm script.
This script is called to validate any user who attempts to login to the
barracuda's web interface (typically at http://<deviceIP>:8080 or
https://<deviceIP>). While the guest account has limited access, the
following information can be obtained:

 * system configuration including IP accesses, admin IP ACLs
 * email message logs (but not the content of the messages)
 * version information of both spam/antivirus definitions and system
firmware version

Used in conjunction with the vulnerability "Barracuda Arbitrary File
Disclosure" (NNL-20060801-02), the integrity of the system can be
compromised. An attacker can use both vulnerabilities to download both
confidential emails as well as the configuration information (including
the admin password).

Additionally, while some accounts such as "admin" are bound by user
definable IP ACLs, the guest account is not. This means that sensitive
information can be disclosed to ANY IP address regardless of the user
defined network restrictions.

Proof of Concept:
Enter the username "guest" into the login page of any open barracuda and
the password "bnadmin99" 

Recommendations:
* Never allow your barracuda web interface to be accessible from
untrusted networks (especially the Internet)

* Upgrade to version 3.3.0.54 or later

Vendor Contact:
29 May 2006   - Initial Vendor Contact
24 June 2006  - Vendor replies with prospect of fix
17 July 2006  - NNL request status update, no reply
01 Aug 2006   - NNL releases vuln report, notifies vendor of release